@michengai/dsh-skills-manager 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,101 @@
+<p align="center">
+  <img src="assets/icon.png" alt="DSH Skills Manager" width="96">
+</p>
+
+<h1 align="center">DSH Skills Manager</h1>
+
+<p align="center">
+  <strong>Manage local DeepSeek Harness skills with a clear boundary for shared Agent skills.</strong>
+</p>
+
+<p align="center">
+  <a href="https://github.com/MichengAI/dsh-skills-manager/issues">Report an issue</a>
+</p>
+
+<p align="center">
+  <strong>English</strong> · <a href="README.zh-CN.md">简体中文</a>
+</p>
+
+<p align="center">
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-blue.svg" alt="Apache License 2.0"></a>
+  <img src="https://img.shields.io/badge/DSH-Web%20Plugin-10b981" alt="DSH Web Plugin">
+  <img src="https://img.shields.io/badge/Node.js-%E2%89%A520-339933?logo=nodedotjs&logoColor=white" alt="Node.js 20 or later">
+</p>
+
+<p align="center">
+  <img src="assets/screenshots/skills-manager.png" alt="Native file picker opened from the Skills settings panel" width="960">
+</p>
+
+> The screenshot shows the Skills panel layout. In the current plugin, shared Agent skills are read-only and do not expose action buttons.
+
+> DSH Skills Manager is a community-maintained plugin. It is not an official DeepSeek AI product.
+
+## What it provides
+
+- **Two skill groups** — view local `$DSH_HOME\skills` and shared `$DSH_AGENTS_HOME\skills` in one Settings panel.
+- **Local lifecycle controls** — enable, disable, upload, replace, and delete only DSH-local skills.
+- **Safe shared-skill view** — public Agent skills are visible but strictly read-only; their global metadata is never changed.
+- **Native file selection** — select a plugin `SKILL.md` from the operating system file picker, or explicitly choose its directory when the client cannot expose the selected file path.
+- **Protected replacement** — a same-name import always requires confirmation, including a flat skill and a bundled skill with the same normalized name.
+- **Predictable dialogs** — Escape closes only the active upload or confirmation dialog, leaving the Settings page open.
+
+## Directory permissions
+
+| Directory | View | Enable/Disable | Upload/Replace | Delete |
+| --- | --- | --- | --- | --- |
+| `$DSH_HOME\skills` | Yes | Yes | Yes | Yes |
+| `$DSH_AGENTS_HOME\skills` | Yes | No | No | No |
+
+The shared Agent directory is intentionally read-only in both the interface and the server API.
+
+## Install
+
+Requirements: a working DeepSeek Harness Web installation. The published package declares Node.js 20 or later for the DSH runtime.
+
+Install the published package into the Web profile:
+
+```powershell
+[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
+$OutputEncoding = [System.Text.Encoding]::UTF8
+dsh plugin --profile web add @michengai/dsh-skills-manager
+```
+
+No source checkout is required. Restart DSH, then open **Settings → Skills**. If a package mirror has not synchronized the latest version yet, append `--registry=https://registry.npmjs.org/` to the install command.
+
+## How to use it
+
+1. Open **Settings → Skills**. The panel separates **DSH Skills** from **Shared Agent Skills** and shows each skill's name, form, description, and current invocation status.
+2. In **DSH Skills**, choose **Enable** or **Disable** to control both model invocation and the `/` manual command. Other `SKILL.md` metadata remains untouched.
+3. Choose **Upload Plugin** in the upper-right corner. Select the plugin directory's `SKILL.md`; the complete plugin directory is copied to `$DSH_HOME\skills`.
+4. When the browser does not provide the selected file path, use **Choose Plugin Directory** in the dialog and select the directory that contains `SKILL.md`.
+5. Confirm any replacement of a same-name skill. Use **Delete** only for DSH-local skills you no longer need.
+6. Treat **Shared Agent Skills** as an inspection list: their controls are deliberately unavailable so the shared global skill metadata stays unchanged.
+
+## Development and verification
+
+```powershell
+[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
+$OutputEncoding = [System.Text.Encoding]::UTF8
+node test\core-test.mjs
+```
+
+## Project documentation
+
+Project status, usage boundaries, architecture, and iteration records start at the [documentation entry point](https://github.com/MichengAI/dsh-skills-manager/blob/master/docs/00-%E4%BA%A4%E6%8E%A5%E5%85%A5%E5%8F%A3/00-%E9%98%85%E8%AF%BB%E5%AF%BC%E8%88%AA.md). The Chinese operational guide is available at `docs\02-产品与业务\01-使用说明.md` in the repository.
+
+## Publishing
+
+The user-level npm registry may point to a download mirror such as `registry.npmmirror.com`; mirrors do not accept publication. This package therefore pins publication to the official npm registry. A maintainer with npm publishing access can release the current version with:
+
+```powershell
+[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
+$OutputEncoding = [System.Text.Encoding]::UTF8
+npm login --registry=https://registry.npmjs.org/
+npm publish
+```
+
+`prepublishOnly` runs the core test suite before publication, and `publishConfig.registry` prevents `npm publish` from going to a configured download mirror. Use `npm run pack:check` to inspect the exact tarball contents without publishing.
+
+## License
+
+Licensed under the [Apache License 2.0](LICENSE).

package/README.zh-CN.md

@@ -0,0 +1,101 @@
+<p align="center">
+  <img src="assets/icon.png" alt="DSH Skills Manager" width="96">
+</p>
+
+<h1 align="center">DSH Skills Manager</h1>
+
+<p align="center">
+  <strong>管理本地 DeepSeek Harness 技能，并为公共 Agent 技能提供清晰、安全的查看边界。</strong>
+</p>
+
+<p align="center">
+  <a href="https://github.com/MichengAI/dsh-skills-manager/issues">反馈问题</a>
+</p>
+
+<p align="center">
+  <a href="README.md">English</a> · <strong>简体中文</strong>
+</p>
+
+<p align="center">
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-blue.svg" alt="Apache License 2.0"></a>
+  <img src="https://img.shields.io/badge/DSH-Web%20Plugin-10b981" alt="DSH Web Plugin">
+  <img src="https://img.shields.io/badge/Node.js-%E2%89%A520-339933?logo=nodedotjs&logoColor=white" alt="Node.js 20 或更高版本">
+</p>
+
+<p align="center">
+  <img src="assets/screenshots/skills-manager.png" alt="从技能设置面板打开的系统原生文件选择器" width="960">
+</p>
+
+> 截图展示技能面板的整体布局。当前版本中的公共 Agent 技能为只读，不会显示操作按钮。
+
+> DSH Skills Manager 是社区维护的插件，并非 DeepSeek AI 官方产品。
+
+## 核心能力
+
+- **双目录分组**：在一个设置面板中查看本地 `$DSH_HOME\skills` 与公共 `$DSH_AGENTS_HOME\skills`。
+- **本地技能管理**：仅对 DSH 本地技能提供启用、停用、上传、覆盖和删除。
+- **公共技能安全查看**：公共 Agent 技能可见但严格只读，绝不会改写其全局元数据。
+- **系统原生选择**：通过操作系统文件选择器选择插件的 `SKILL.md`；客户端无法提供所选文件路径时，可显式选择插件目录。
+- **覆盖保护**：导入同名技能一定要求确认；flat 与 bundle 两种形态同名时同样如此。
+- **弹窗行为可预期**：按 ESC 只关闭当前上传框或确认框，不会关闭设置页面。
+
+## 目录权限
+
+| 目录 | 查看 | 启用/停用 | 上传/覆盖 | 删除 |
+| --- | --- | --- | --- | --- |
+| `$DSH_HOME\skills` | 支持 | 支持 | 支持 | 支持 |
+| `$DSH_AGENTS_HOME\skills` | 支持 | 不支持 | 不支持 | 不支持 |
+
+公共 Agent 目录在界面和服务端均为只读，用于避免误改共享的全局技能元数据。
+
+## 安装
+
+环境要求：可正常运行的 DeepSeek Harness Web 环境。已发布的包会声明 DSH 运行时需要 Node.js 20 或更高版本。
+
+将已发布 npm 包安装到 Web profile：
+
+```powershell
+[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
+$OutputEncoding = [System.Text.Encoding]::UTF8
+dsh plugin --profile web add @michengai/dsh-skills-manager
+```
+
+无需下载源码。重启 DSH 后，打开「设置 → 技能」。若软件源镜像尚未同步最新版本，可在安装命令末尾添加 `--registry=https://registry.npmjs.org/`。
+
+## 使用说明
+
+1. 打开「设置 → 技能」。面板会区分「DSH 技能」和「公共 Agent 技能」，并展示每个技能的名称、形态、说明和调用状态。
+2. 仅在「DSH 技能」分组中使用「启用」或「停用」。它会同步控制模型调用和 `/` 手动命令，且不会改写 `SKILL.md` 的其他元数据。
+3. 点击右上角「上传插件」，选择插件目录中的 `SKILL.md`；整个插件目录会复制到 `$DSH_HOME\skills`。
+4. 若客户端无法提供所选文件路径，在弹窗中点击「选择插件文件夹」，并选择包含 `SKILL.md` 的目录。
+5. 遇到同名技能时，根据提示确认是否覆盖；仅在「DSH 技能」分组中使用「删除」移除不再需要的插件。
+6. 「公共 Agent 技能」仅供智能查看，不提供启停、上传、覆盖或删除，以保护共享的全局技能元数据。
+
+## 开发与验证
+
+```powershell
+[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
+$OutputEncoding = [System.Text.Encoding]::UTF8
+node test\core-test.mjs
+```
+
+## 项目文档
+
+项目状态、使用边界、技术架构和迭代记录从[文档交接入口](https://github.com/MichengAI/dsh-skills-manager/blob/master/docs/00-%E4%BA%A4%E6%8E%A5%E5%85%A5%E5%8F%A3/00-%E9%98%85%E8%AF%BB%E5%AF%BC%E8%88%AA.md)开始；详细操作说明见仓库中的 `docs\02-产品与业务\01-使用说明.md`。
+
+## 发布 npm 包
+
+用户级 npm registry 可能指向 `registry.npmmirror.com` 等下载镜像；镜像不接受发布。本包已固定发布目标为官方 npm registry，拥有 npm 发布权限的维护者可执行：
+
+```powershell
+[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
+$OutputEncoding = [System.Text.Encoding]::UTF8
+npm login --registry=https://registry.npmjs.org/
+npm publish
+```
+
+发布前会由 `prepublishOnly` 自动运行核心测试，`publishConfig.registry` 会避免 `npm publish` 写入下载镜像。执行 `npm run pack:check` 可在不发布的情况下检查最终 tarball 内容。
+
+## 许可证
+
+本项目采用 [Apache License 2.0](LICENSE)。

package/cordis.patch.yml

@@ -0,0 +1,7 @@
+# dsh-skills-manager bundle patch
+#
+# 供 `dsh plugin --profile web add <路径>` 自动挂载（Loader bundle 层）；
+# 手动挂载的用户也可在 profiles/web/cordis.patch.yml 自行添加 insert 条目。
+- insert:
+    - id: skills-manager
+      name: '@michengai/dsh-skills-manager'

package/lib/client.js

@@ -0,0 +1,237 @@
+// dsh-skills-manager client half：DSH 设置中的单目录技能管理面板。
+window.__ModuleLoader__.load({
+  id: "dsh-skills-manager",
+  factory: (require) => {
+    var module = { exports: {} };
+    Object.defineProperty(module.exports, Symbol.toStringTag, { value: "Module" });
+    var react = require("react");
+    var h = react.createElement;
+    var pickDirectory = null;
+
+    var CSS = `
+.dssm-section{display:flex;min-width:0;flex-direction:column;gap:20px;color:var(--dsw-alias-label-primary)}
+.dssm-toolbar{display:flex;align-items:flex-start;gap:16px;padding-bottom:16px;border-bottom:1px solid var(--dsw-alias-border-l2)}
+.dssm-title{margin:0;font-size:20px;line-height:28px;font-weight:650;letter-spacing:-.2px}.dssm-desc{margin:4px 0 0;color:var(--dsw-alias-label-secondary);font-size:13px;line-height:20px}
+.dssm-actions{display:flex;align-items:center;gap:8px;margin-left:auto}.dssm-btn{box-sizing:border-box;display:inline-flex;align-items:center;justify-content:center;min-height:34px;padding:0 13px;border:1px solid transparent;border-radius:8px;background:var(--dsw-alias-button-primary-fill);color:var(--dsw-alias-label-primary-foreground);font:inherit;font-size:13px;font-weight:550;cursor:pointer;transition:opacity 180ms ease,background 180ms ease,border-color 180ms ease}
+.dssm-btn:hover:not(:disabled){opacity:.9}.dssm-btn:disabled{opacity:.5;cursor:default}.dssm-btn-secondary{background:transparent;border-color:var(--dsw-alias-border-l2);color:var(--dsw-alias-label-primary)}.dssm-btn-danger{background:transparent;border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary)}
+.dssm-btn:focus-visible,.dssm-dropzone:focus-visible,.dssm-icon-btn:focus-visible{outline:2px solid var(--dsw-alias-state-success-primary);outline-offset:2px}.dssm-summary{display:flex;align-items:center;gap:12px;padding:12px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-layer-2)}
+.dssm-summary-count{font-size:18px;font-weight:650}.dssm-summary-label{color:var(--dsw-alias-label-secondary);font-size:12px}.dssm-summary-separator{width:1px;height:24px;background:var(--dsw-alias-border-l2)}
+.dssm-group{display:flex;flex-direction:column;overflow:hidden;border:1px solid var(--dsw-alias-border-l2);border-radius:12px;background:var(--dsw-alias-bg-layer-2)}.dssm-group-head{display:flex;align-items:center;gap:10px;padding:14px 16px;border-bottom:1px solid var(--dsw-alias-border-l1)}.dssm-group-title{margin:0;font-size:14px;font-weight:600}.dssm-count{color:var(--dsw-alias-label-tertiary);font-size:12px}.dssm-path{margin-left:auto;max-width:48%;overflow:hidden;color:var(--dsw-alias-label-tertiary);font-size:12px;text-overflow:ellipsis;white-space:nowrap}
+.dssm-row{display:flex;align-items:center;gap:12px;padding:13px 16px;border-bottom:1px solid var(--dsw-alias-border-l1)}.dssm-row:last-child{border-bottom:0}.dssm-row-main{display:flex;min-width:0;flex:1;flex-direction:column;gap:3px}.dssm-row-id{display:flex;align-items:center;gap:7px;min-width:0}.dssm-row-name{overflow:hidden;font-size:14px;font-weight:560;line-height:20px;text-overflow:ellipsis;white-space:nowrap}.dssm-tag{flex:none;padding:1px 6px;border:1px solid var(--dsw-alias-border-l3);border-radius:4px;color:var(--dsw-alias-label-secondary);font-size:11px;line-height:16px}.dssm-tag-on{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary)}.dssm-tag-off{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary)}.dssm-note{overflow:hidden;color:var(--dsw-alias-label-secondary);font-size:12px;line-height:18px;text-overflow:ellipsis;white-space:nowrap}.dssm-empty{padding:28px 16px;color:var(--dsw-alias-label-tertiary);font-size:13px;text-align:center}.dssm-error{color:var(--dsw-alias-state-error-primary);font-size:13px;line-height:20px}
+.dssm-mask{position:fixed;z-index:1100;inset:0;display:flex;align-items:center;justify-content:center;padding:24px;background:rgba(0,0,0,.58)}.dssm-modal{box-sizing:border-box;display:flex;width:min(480px,100%);flex-direction:column;gap:18px;padding:24px;border:1px solid var(--dsw-alias-border-l2);border-radius:16px;background:var(--dsw-alias-bg-layer-2);box-shadow:var(--dsw-shadow-lv3)}.dssm-modal-head{display:flex;align-items:center;gap:12px}.dssm-modal-title{margin:0;flex:1;font-size:17px;line-height:24px;font-weight:650}.dssm-icon-btn{display:inline-flex;align-items:center;justify-content:center;width:30px;height:30px;border:0;border-radius:7px;background:transparent;color:var(--dsw-alias-label-secondary);font:inherit;font-size:20px;line-height:1;cursor:pointer}.dssm-icon-btn:hover{background:var(--dsw-alias-interactive-bg-hover)}
+.dssm-dropzone{display:flex;min-height:144px;flex-direction:column;align-items:center;justify-content:center;gap:8px;padding:18px;border:1px dashed var(--dsw-alias-border-l3);border-radius:12px;background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-secondary);cursor:pointer;transition:border-color 180ms ease,background 180ms ease}.dssm-dropzone:hover,.dssm-dropzone-active{border-color:var(--dsw-alias-state-success-primary);background:var(--dsw-alias-interactive-bg-hover)}.dssm-dropzone-title{color:var(--dsw-alias-label-primary);font-size:14px;font-weight:560}.dssm-dropzone-copy{font-size:12px;line-height:18px;text-align:center}.dssm-file{display:flex;align-items:center;gap:8px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;color:var(--dsw-alias-label-primary);font-size:13px}.dssm-file-name{overflow:hidden;flex:1;text-overflow:ellipsis;white-space:nowrap}.dssm-modal-actions{display:flex;justify-content:flex-end;gap:8px}.dssm-hidden-input{display:none}
+@media (max-width:560px){.dssm-toolbar{flex-wrap:wrap}.dssm-actions{margin-left:0}.dssm-path{display:none}.dssm-row{align-items:flex-start;flex-wrap:wrap}.dssm-row>.dssm-btn{margin-left:auto}}@media (prefers-reduced-motion:reduce){.dssm-btn,.dssm-dropzone{transition:none}}
+`;
+
+    function callApi(path, options) {
+      return fetch("/api/dsh-skills-manager" + path, options).then(function (response) {
+        return response.json().then(function (payload) {
+          if (!payload.ok) throw new Error(payload.error || ("HTTP " + response.status));
+          return payload.data;
+        });
+      });
+    }
+
+    function SkillManagerSection() {
+      var snapshotState = react.useState({ loading: true, error: null, data: null });
+      var snapshot = snapshotState[0];
+      var setSnapshot = snapshotState[1];
+      var busyState = react.useState(null);
+      var busy = busyState[0];
+      var setBusy = busyState[1];
+      var uploadState = react.useState(false);
+      var uploadOpen = uploadState[0];
+      var setUploadOpen = uploadState[1];
+      var selectedState = react.useState(null);
+      var selected = selectedState[0];
+      var setSelected = selectedState[1];
+      var resultState = react.useState(null);
+      var importResult = resultState[0];
+      var setImportResult = resultState[1];
+      var confirmState = react.useState(null);
+      var confirmImport = confirmState[0];
+      var setConfirmImport = confirmState[1];
+      var deleteState = react.useState(null);
+      var confirmDelete = deleteState[0];
+      var setConfirmDelete = deleteState[1];
+      var inputRef = react.useRef(null);
+
+      function refresh() {
+        setSnapshot({ loading: true, error: null, data: snapshot.data });
+        callApi("/state").then(function (data) {
+          setSnapshot({ loading: false, error: null, data: data });
+        }).catch(function (error) {
+          setSnapshot({ loading: false, error: String(error && error.message || error), data: snapshot.data });
+        });
+      }
+
+      react.useEffect(function () { refresh(); }, []);
+
+      react.useEffect(function () {
+        if (!uploadOpen && !confirmImport && !confirmDelete) return undefined;
+        function closeTopModal(event) {
+          if (event.key !== "Escape") return;
+          event.preventDefault();
+          event.stopPropagation();
+          if (event.stopImmediatePropagation) event.stopImmediatePropagation();
+          if (confirmDelete) setConfirmDelete(null);
+          else if (confirmImport) setConfirmImport(null);
+          else setUploadOpen(false);
+        }
+        window.addEventListener("keydown", closeTopModal, true);
+        return function () { window.removeEventListener("keydown", closeTopModal, true); };
+      }, [uploadOpen, confirmImport, confirmDelete]);
+
+      function action(path, body) {
+        if (busy) return;
+        setBusy(path);
+        callApi(path, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body || {}) }).then(function () {
+          setBusy(null);
+          refresh();
+        }).catch(function (error) {
+          setBusy(null);
+          setSnapshot({ loading: false, error: String(error && error.message || error), data: snapshot.data });
+        });
+      }
+
+      function selectFile(file) {
+        if (!file) return;
+        if (file.name.toLowerCase() !== "skill.md") {
+          setImportResult({ error: "请选择插件目录中的 SKILL.md 文件。" });
+          return;
+        }
+        if (!file.path) {
+          setSelected(null);
+          setImportResult({ error: "已选择 SKILL.md，但当前运行环境无法读取文件路径。请点击“选择插件文件夹”继续上传。" });
+          return;
+        }
+        setSelected({ name: file.name, source: file.path });
+        setImportResult(null);
+      }
+
+      function selectDirectory() {
+        if (!pickDirectory) {
+          setImportResult({ error: "当前运行环境无法读取本地文件路径，也未提供原生目录选择服务。" });
+          return;
+        }
+        setImportResult(null);
+        setBusy("pick-directory");
+        pickDirectory().then(function (path) {
+          setBusy(null);
+          if (path) {
+            setSelected({ name: "已选择插件目录", source: path });
+            setImportResult(null);
+          }
+        }).catch(function (error) {
+          setBusy(null);
+          setImportResult({ error: "选择插件目录失败：" + String(error && error.message || error) });
+        });
+      }
+
+      function openNativePicker() {
+        if (!busy && inputRef.current) inputRef.current.click();
+      }
+
+      function executeImport(source, conflict) {
+        setBusy("import");
+        setConfirmImport(null);
+        callApi("/import", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ source: source, conflict: conflict }) }).then(function (data) {
+          setBusy(null);
+          setImportResult(data);
+          setSelected(null);
+          setUploadOpen(false);
+          refresh();
+        }).catch(function (error) {
+          setBusy(null);
+          setImportResult({ error: String(error && error.message || error) });
+        });
+      }
+
+      function installSelected() {
+        if (!selected || busy) return;
+        setBusy("import-check");
+        callApi("/import", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ source: selected.source, dryRun: true }) }).then(function (data) {
+          if (data.conflicts && data.conflicts.length) {
+            setBusy(null);
+            setConfirmImport({ source: selected.source, conflicts: data.conflicts });
+            return;
+          }
+          executeImport(selected.source, "skip");
+        }).catch(function (error) {
+          setBusy(null);
+          setImportResult({ error: String(error && error.message || error) });
+        });
+      }
+
+      function skillRow(skill, root) {
+        var enabled = skill.modelInvocable && skill.userInvocable;
+        return h("div", { key: skill.name, className: "dssm-row" },
+          h("div", { className: "dssm-row-main" },
+            h("div", { className: "dssm-row-id" },
+              h("span", { className: "dssm-row-name" }, skill.name),
+              h("span", { className: "dssm-tag" }, skill.kind === "bundle" ? "目录插件" : "单文件"),
+              h("span", { className: "dssm-tag " + (enabled ? "dssm-tag-on" : "dssm-tag-off") }, enabled ? "已启用" : "已停用")),
+            h("div", { className: "dssm-note", title: skill.description || "" }, skill.description || "未提供简介")),
+          root.mutable ? h("button", { className: "dssm-btn dssm-btn-secondary", disabled: !!busy, onClick: function () { action(enabled ? "/disable" : "/enable", { name: skill.name, root: root.key }); } }, enabled ? "停用" : "启用") : null,
+          root.mutable ? h("button", { className: "dssm-btn dssm-btn-danger", disabled: !!busy, onClick: function () { setConfirmDelete(skill); } }, "删除") : null);
+      }
+
+      var nodes = [h("style", { key: "css" }, CSS)];
+      if (snapshot.error) nodes.push(h("div", { key: "error", className: "dssm-error", role: "alert" }, "操作失败：" + snapshot.error));
+      if (snapshot.data) {
+        var roots = snapshot.data.roots || [];
+        var skills = roots.reduce(function (all, root) { return all.concat(root.skills || []); }, []);
+        var enabled = skills.filter(function (skill) { return skill.modelInvocable; }).length;
+        nodes.push(h("div", { key: "toolbar", className: "dssm-toolbar" },
+          h("div", null, h("h2", { className: "dssm-title" }, "技能"), h("p", { className: "dssm-desc" }, "DSH 技能可上传、启停和删除；公共 Agent 技能仅供查看。")),
+          h("div", { className: "dssm-actions" },
+            h("button", { className: "dssm-btn dssm-btn-secondary", disabled: !!busy, onClick: refresh }, "刷新"),
+            h("button", { className: "dssm-btn", disabled: !!busy, onClick: function () { setImportResult(null); setUploadOpen(true); } }, "上传插件"))));
+        nodes.push(h("div", { key: "summary", className: "dssm-summary" },
+          h("span", { className: "dssm-summary-count" }, skills.length), h("span", { className: "dssm-summary-label" }, "个插件"), h("span", { className: "dssm-summary-separator" }), h("span", { className: "dssm-summary-count" }, enabled), h("span", { className: "dssm-summary-label" }, "个已启用")));
+        roots.forEach(function (root) {
+          var groupSkills = root.skills || [];
+          nodes.push(h("div", { key: root.key, className: "dssm-group" },
+            h("div", { className: "dssm-group-head" }, h("h3", { className: "dssm-group-title" }, root.label), h("span", { className: "dssm-count" }, groupSkills.length + " 个"), h("span", { className: "dssm-path", title: root.path }, root.path)),
+            root.exists === false ? h("div", { className: "dssm-empty" }, root.mutable ? "目录尚未创建，上传第一个插件后会自动创建。" : "公共目录不存在。") : (groupSkills.length ? groupSkills.map(function (skill) { return skillRow(skill, root); }) : h("div", { className: "dssm-empty" }, "暂未安装插件。"))));
+        });
+      } else if (snapshot.loading) {
+        nodes.push(h("div", { key: "loading", className: "dssm-note" }, "加载中…"));
+      }
+      if (importResult) {
+        var importedNames = (importResult.imported || []).map(function (item) { return item.name; });
+        var failedItems = importResult.failed || [];
+        var failedText = failedItems.map(function (item) { return item.error; }).join("；");
+        var resultText = importResult.error ? "上传失败：" + importResult.error : failedItems.length ? (importedNames.length ? "部分上传成功：" + importedNames.join("、") + "；失败：" + failedText : "上传失败：" + failedText) : "上传完成：" + importedNames.join("、");
+        nodes.push(h("div", { key: "import-result", className: importResult.error || failedItems.length ? "dssm-error" : "dssm-note", role: "status" }, resultText));
+      }
+      if (uploadOpen) {
+        nodes.push(h("div", { key: "upload", className: "dssm-mask" }, h("div", { className: "dssm-modal", role: "dialog", "aria-modal": "true", "aria-labelledby": "dssm-upload-title" },
+          h("div", { className: "dssm-modal-head" }, h("h3", { id: "dssm-upload-title", className: "dssm-modal-title" }, "上传插件"), h("button", { className: "dssm-icon-btn", "aria-label": "关闭上传弹窗", onClick: function () { setUploadOpen(false); } }, "×")),
+          h("input", { ref: inputRef, className: "dssm-hidden-input", type: "file", accept: ".md", onChange: function (event) { selectFile(event.target.files && event.target.files[0]); event.target.value = ""; } }),
+          h("div", { className: "dssm-dropzone", tabIndex: 0, onClick: openNativePicker, onKeyDown: function (event) { if (event.key === "Enter" || event.key === " ") { event.preventDefault(); openNativePicker(); } }, onDragOver: function (event) { event.preventDefault(); }, onDrop: function (event) { event.preventDefault(); selectFile(event.dataTransfer.files && event.dataTransfer.files[0]); } }, h("span", { className: "dssm-dropzone-title" }, "拖放 SKILL.md 文件到这里"), h("span", { className: "dssm-dropzone-copy" }, "或点击打开系统原生文件选择窗口")),
+          selected ? h("div", { className: "dssm-file", title: selected.source }, h("span", { className: "dssm-file-name" }, selected.name), h("span", { className: "dssm-tag dssm-tag-on" }, "已选择")) : h("p", { className: "dssm-desc" }, "请选择插件目录中的 SKILL.md；目录内其他文件会一并上传。"),
+          busy === "pick-directory" ? h("div", { className: "dssm-note", role: "status" }, "正在打开系统原生目录选择窗口…") : null,
+          importResult && importResult.error ? h("div", { className: "dssm-error", role: "alert" }, "选择失败：" + importResult.error) : null,
+          h("div", { className: "dssm-modal-actions" }, h("button", { className: "dssm-btn dssm-btn-secondary", disabled: !!busy, onClick: openNativePicker }, "选择本地文件"), pickDirectory ? h("button", { className: "dssm-btn dssm-btn-secondary", disabled: !!busy, onClick: selectDirectory }, "选择插件文件夹") : null, h("button", { className: "dssm-btn", disabled: !selected || !!busy, onClick: installSelected }, busy === "import" || busy === "import-check" ? "上传中…" : "上传到 DSH")))));
+      }
+      if (confirmImport) {
+        nodes.push(h("div", { key: "import-confirm", className: "dssm-mask" }, h("div", { className: "dssm-modal", role: "dialog", "aria-modal": "true" }, h("div", { className: "dssm-modal-head" }, h("h3", { className: "dssm-modal-title" }, "发现同名插件")), h("p", { className: "dssm-desc" }, "将覆盖现有插件：" + confirmImport.conflicts.map(function (item) { return item.name; }).join("、")), h("div", { className: "dssm-modal-actions" }, h("button", { className: "dssm-btn dssm-btn-secondary", onClick: function () { setConfirmImport(null); } }, "取消"), h("button", { className: "dssm-btn", disabled: !!busy, onClick: function () { executeImport(confirmImport.source, "overwrite"); } }, "覆盖上传")))));
+      }
+      if (confirmDelete) {
+        nodes.push(h("div", { key: "delete-confirm", className: "dssm-mask" }, h("div", { className: "dssm-modal", role: "dialog", "aria-modal": "true" }, h("div", { className: "dssm-modal-head" }, h("h3", { className: "dssm-modal-title" }, "删除插件？")), h("p", { className: "dssm-desc" }, "“" + confirmDelete.name + "”将从 DSH 技能目录中永久删除，无法恢复。"), h("div", { className: "dssm-modal-actions" }, h("button", { className: "dssm-btn dssm-btn-secondary", disabled: !!busy, onClick: function () { setConfirmDelete(null); } }, "取消"), h("button", { className: "dssm-btn dssm-btn-danger", disabled: !!busy, onClick: function () { setConfirmDelete(null); action("/delete", { name: confirmDelete.name }); } }, "确认删除")))));
+      }
+      return h("section", { className: "dssm-section" }, nodes);
+    }
+
+    function apply(ctx) {
+      pickDirectory = function () { return ctx.workspaces.pickDirectory(); };
+      ctx.slots.inject("settings.section", function () {
+        return ctx.slots.register({ name: "settings.section", id: "skills-manager", order: 17, label: "技能" }, SkillManagerSection);
+      });
+    }
+    module.exports.apply = apply;
+    module.exports.inject = ["slots", "workspaces"];
+    return module.exports;
+  }
+});

package/lib/core.js

@@ -0,0 +1,423 @@
+// dsh-skills-manager core —— 纯 Node 技能文件管理核心（零第三方依赖，可独立单测）
+//
+// 覆盖 DSH 用户级技能根：
+//   - 根目录：~/.dsh/skills
+//   - 条目形态：<root>/<name>/SKILL.md（bundle）或 <root>/<name>.md（flat），只扫一层
+//   - 前端展示 name、description 与启停状态，不做格式检查或自动修复
+//
+// 所有函数返回普通结果对象，失败时返回 { ok: false, error }；写文件/日志失败静默降级。
+
+import { homedir } from "node:os";
+import { join, basename, dirname } from "node:path";
+import { promises as fs } from "node:fs";
+
+const KEBAB_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+
+// ── 路径解析 ────────────────────────────────────────────────────────────────
+
+export function resolveDshHome() {
+  return process.env.DSH_HOME || join(homedir(), ".dsh");
+}
+
+export function resolveAgentsHome() {
+  return process.env.DSH_AGENTS_HOME || join(homedir(), ".agents");
+}
+
+/** DSH 可管理目录与只读的公共 Agent 目录。 */
+export function userRoots() {
+  return [
+    { key: "dsh", path: join(resolveDshHome(), "skills"), label: "DSH 技能", mutable: true },
+    { key: "agents", path: join(resolveAgentsHome(), "skills"), label: "公共 Agent 技能", mutable: false },
+  ];
+}
+
+export function logPath() {
+  return join(resolveDshHome(), "dsh-skills-manager.log");
+}
+
+// ── 命名规整 ────────────────────────────────────────────────────────────────
+
+/** 尽量把任意名称规整为 kebab-case；无法生成合法名称时返回空串。 */
+export function toKebab(s) {
+  let t = String(s).trim();
+  if (t === "") return "";
+  t = t.replace(/([a-z0-9])([A-Z])/g, "$1-$2"); // camelCase 边界
+  t = t.toLowerCase();
+  t = t.replace(/[\s_.]+/g, "-");
+  t = t.replace(/[^a-z0-9-]/g, "-");
+  t = t.replace(/-+/g, "-").replace(/^-+|-+$/g, "");
+  return t;
+}
+
+// ── frontmatter 解析 / 序列化（宽松 YAML 对象，保留键序）────────────────────
+
+/** 剥离 UTF-8 BOM（Windows 工具常写入，不剥离会导致开头 --- 失配）。 */
+function stripBom(text) {
+  return text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+}
+
+/** 解析 SKILL.md 的 frontmatter。返回 { fields, map, body }，map 保留键序。 */
+export function parseSkillDoc(text) {
+  const src = stripBom(String(text));
+  const lines = src.split(/\r?\n/);
+  const map = {};
+  const fields = [];
+  let body = src;
+  if (lines.length > 0 && lines[0].trim() === "---") {
+    let end = -1;
+    for (let i = 1; i < lines.length; i++) {
+      if (lines[i].trim() === "---") {
+        end = i;
+        break;
+      }
+    }
+    if (end >= 0) {
+      for (let i = 1; i < end; i++) {
+        const m = /^([A-Za-z0-9_-]+)\s*:\s*(.*)$/.exec(lines[i]);
+        if (m) {
+          fields.push({ key: m[1], raw: m[2] });
+          const block = /^([>|])[-+]?\s*$/.exec(m[2]);
+          if (block) {
+            const content = [];
+            while (i + 1 < end && (/^\s/.test(lines[i + 1]) || lines[i + 1] === "")) {
+              i++;
+              content.push(lines[i].replace(/^\s{1,2}/, ""));
+            }
+            map[m[1]] = block[1] === ">" ? content.join(" ").replace(/\s+/g, " ").trim() : content.join("\n").trim();
+          } else {
+            map[m[1]] = decodeYamlScalar(m[2]);
+          }
+        }
+      }
+      body = lines.slice(end + 1).join("\n");
+    }
+  }
+  return { fields, map, body };
+}
+
+/** 读取 YAML 标量的显示值；不依赖第三方 YAML 解析器。 */
+function decodeYamlScalar(v) {
+  const s = String(v == null ? "" : v).trim();
+  if (s.length >= 2 && s[0] === '"' && s[s.length - 1] === '"') {
+    try {
+      const value = JSON.parse(s);
+      if (typeof value === "string") return value;
+    } catch {
+      /* 保留无法解析的原始内容 */
+    }
+  }
+  if (s.length >= 2 && s[0] === "'" && s[s.length - 1] === "'") return s.slice(1, -1).replace(/''/g, "'");
+  return s;
+}
+
+export function unquote(v) {
+  const s = String(v == null ? "" : v).trim();
+  if (s.length >= 2 && ((s[0] === '"' && s[s.length - 1] === '"') || (s[0] === "'" && s[s.length - 1] === "'"))) {
+    return s.slice(1, -1);
+  }
+  return s;
+}
+
+/** 把 JS 值序列化为 YAML 标量；需要转义的字符串用 JSON 引号形式。 */
+export function yamlScalar(v) {
+  if (v === true) return "true";
+  if (v === false) return "false";
+  if (v === null || v === undefined) return "null";
+  if (typeof v === "number") return String(v);
+  const s = String(v);
+  if (s === "") return '""';
+  if (/^(true|false|null|yes|no|on|off|~)$/i.test(s) || /^[-+]?\d+(\.\d+)?$/.test(s)) return JSON.stringify(s);
+  if (/[:#{}[\]&*,?|>%@`"'\s]/.test(s) || s !== s.trim()) return JSON.stringify(s);
+  return s;
+}
+
+export function serializeSkillDoc(map, body) {
+  let out = "---\n";
+  for (const key of Object.keys(map)) {
+    out += `${key}: ${yamlScalar(map[key])}\n`;
+  }
+  out += "---\n";
+  out += body;
+  return out;
+}
+
+/** 仅更新调用策略行，避免重写并破坏其他 YAML frontmatter。 */
+function updateInvocationPolicy(text, enabled) {
+  const source = String(text);
+  const newline = source.includes("\r\n") ? "\r\n" : "\n";
+  const lines = source.split(/\r?\n/);
+  if (lines[0]?.trim() !== "---") return source;
+  const end = lines.findIndex((line, index) => index > 0 && line.trim() === "---");
+  if (end < 0) return source;
+  const fields = lines.slice(1, end).filter((line) => !/^(disable-model-invocation|user-invocable)\s*:/.test(line));
+  if (!enabled) fields.push("disable-model-invocation: true", "user-invocable: false");
+  return ["---", ...fields, "---", ...lines.slice(end + 1)].join(newline);
+}
+
+/** 解析布尔字段值；合法布尔返回 true/false，非法返回 undefined。 */
+export function parseBoolValue(raw) {
+  const v = unquote(raw).trim().toLowerCase();
+  if (v === "true" || v === "yes" || v === "on" || v === "1") return true;
+  if (v === "false" || v === "no" || v === "off" || v === "0") return false;
+  return undefined;
+}
+
+// ── 条目定位 / 扫描 ─────────────────────────────────────────────────────────
+
+/** 按名称解析条目（bundle 优先，其次 flat）。找不到返回 null。 */
+export async function resolveEntry(root, name) {
+  if (typeof name !== "string" || name === "" || basename(name) !== name) return null;
+  const bundleDoc = join(root, name, "SKILL.md");
+  try {
+    const st = await fs.stat(bundleDoc);
+    if (st.isFile()) return { kind: "bundle", docPath: bundleDoc };
+  } catch {}
+  const flatDoc = join(root, `${name}.md`);
+  try {
+    const st = await fs.stat(flatDoc);
+    if (st.isFile()) return { kind: "flat", docPath: flatDoc };
+  } catch {}
+  return null;
+}
+
+function entryOf(name, kind, docPath, doc) {
+  const description = doc.map.description !== undefined ? unquote(doc.map.description) : "";
+  const modelDisabled = parseBoolValue(doc.map["disable-model-invocation"]) === true;
+  const userDisabled = parseBoolValue(doc.map["user-invocable"]) === false;
+  return {
+    name,
+    kind,
+    docPath,
+    description,
+    modelInvocable: !modelDisabled,
+    userInvocable: !userDisabled,
+  };
+}
+
+/** 扫描一个技能根（只扫一层）。返回 { exists, entries }。 */
+export async function scanEntries(root) {
+  let items;
+  try {
+    items = await fs.readdir(root, { withFileTypes: true });
+  } catch {
+    return { exists: false, entries: [] };
+  }
+  const entries = [];
+  for (const it of items) {
+    try {
+      if (it.isDirectory()) {
+        const docPath = join(root, it.name, "SKILL.md");
+        const st = await fs.stat(docPath);
+        if (!st.isFile()) continue;
+        const doc = parseSkillDoc(await fs.readFile(docPath, "utf8"));
+        entries.push(entryOf(it.name, "bundle", docPath, doc));
+      } else if (it.isFile() && it.name.endsWith(".md") && it.name !== "SKILL.md") {
+        const docPath = join(root, it.name);
+        const doc = parseSkillDoc(await fs.readFile(docPath, "utf8"));
+        entries.push(entryOf(it.name.slice(0, -3), "flat", docPath, doc));
+      }
+    } catch {
+      /* 跳过不可读条目 */
+    }
+  }
+  entries.sort((a, b) => a.name.localeCompare(b.name));
+  return { exists: true, entries };
+}
+
+// ── 启用 / 停用（同时控制模型与 / 手动调用，非破坏）──────────────────────────
+
+/** enabled=true 恢复模型与 / 手动调用；false 同时停用两种调用入口。 */
+export async function setSkillEnabled(root, name, enabled) {
+  if (root !== userRoots()[0].path) return { ok: false, error: "公共 Agent 技能目录不允许启用或停用" };
+  const resolved = await resolveEntry(root, name);
+  if (resolved === null) return { ok: false, error: `技能不存在: ${name}` };
+  const source = await fs.readFile(resolved.docPath, "utf8");
+  await fs.writeFile(resolved.docPath, updateInvocationPolicy(source, enabled), "utf8");
+  return { name, enabled };
+}
+
+/** 删除 DSH 根目录中的单个技能。调用方必须先向用户确认。 */
+export async function deleteSkill(root, name, log) {
+  if (root !== userRoots()[0].path) return { ok: false, error: "公共 Agent 技能目录不允许删除" };
+  const resolved = await resolveEntry(root, name);
+  if (resolved === null) return { ok: false, error: `技能不存在: ${name}` };
+  const entryPath = resolved.kind === "bundle" ? join(root, name) : resolved.docPath;
+  await fs.rm(entryPath, { recursive: resolved.kind === "bundle", force: true });
+  if (log) log("delete", `删除 ${entryPath}`);
+  return { name };
+}
+
+// ── 导入 ────────────────────────────────────────────────────────────────────
+
+/** 分析来源：单 skill 目录 / 单 .md 文件 / 批量目录。 */
+async function analyzeSource(source) {
+  let st;
+  try {
+    st = await fs.stat(source);
+  } catch {
+    return { kind: "none", error: `路径不存在: ${source}` };
+  }
+  if (st.isDirectory()) {
+    try {
+      const sk = join(source, "SKILL.md");
+      const skSt = await fs.stat(sk);
+      if (skSt.isFile()) {
+        return { kind: "single", rawName: basename(source), kebab: toKebab(basename(source)), source, isDir: true, skillFile: sk };
+      }
+    } catch {}
+    return { kind: "batch", rawName: basename(source), source, isDir: true };
+  }
+  if (st.isFile() && source.toLowerCase().endsWith(".md")) {
+    if (basename(source).toLowerCase() === "skill.md") {
+      const parent = dirname(source);
+      return { kind: "single", rawName: basename(parent), kebab: toKebab(basename(parent)), source: parent, isDir: true, skillFile: source };
+    }
+    const rawName = basename(source).slice(0, -3);
+    return { kind: "single", rawName, kebab: toKebab(rawName), source, isDir: false, skillFile: source };
+  }
+  return { kind: "none", error: `无法识别的 skill 来源: ${source}` };
+}
+
+async function collectCandidates(dir) {
+  const items = await fs.readdir(dir, { withFileTypes: true });
+  const out = [];
+  for (const it of items) {
+    try {
+      if (it.isDirectory()) {
+        const sk = join(dir, it.name, "SKILL.md");
+        const st = await fs.stat(sk);
+        if (st.isFile()) {
+          out.push({ source: join(dir, it.name), kebab: toKebab(it.name), rawName: it.name, isDir: true });
+        }
+      } else if (it.isFile() && it.name.endsWith(".md") && it.name !== "SKILL.md") {
+        out.push({ source: join(dir, it.name), kebab: toKebab(it.name.slice(0, -3)), rawName: it.name.slice(0, -3), isDir: false });
+      }
+    } catch {
+      /* 跳过 */
+    }
+  }
+  return out;
+}
+
+/**
+ * 导入技能到目标根。
+ * options: { conflict: 'skip'|'overwrite', dryRun: boolean }
+ * 成功返回 { kind, imported, skipped, failed }；失败返回 { ok:false, error }。
+ */
+export async function importSkill(source, log, options = {}) {
+  const targetRoot = userRoots()[0].path;
+  const conflict = options.conflict === "overwrite" ? "overwrite" : "skip";
+  const dryRun = options.dryRun === true;
+
+  const analysis = await analyzeSource(source);
+  if (analysis.kind === "none") return { ok: false, error: analysis.error || "无法识别的 skill 来源" };
+
+  let candidates = [];
+  if (analysis.kind === "single") {
+    candidates = [{ source: analysis.source, kebab: analysis.kebab, rawName: analysis.rawName, isDir: analysis.isDir }];
+  } else {
+    candidates = await collectCandidates(source);
+    if (candidates.length === 0) return { ok: false, error: `目录下未找到任何 skill 条目（需含 SKILL.md 的子目录或 .md 文件）: ${source}` };
+  }
+
+  const pending = [];
+  const conflicts = [];
+  const failed = [];
+  const imported = [];
+  const skipped = [];
+
+  function failureResult() {
+    return {
+      ok: false,
+      error: failed.map((item) => item.error).join("；"),
+      kind: analysis.kind,
+      imported,
+      skipped,
+      failed,
+    };
+  }
+
+  for (const c of candidates) {
+    if (!c.kebab || !KEBAB_RE.test(c.kebab)) {
+      failed.push({ source: c.source, error: `无法生成合法 kebab-case 名称（原始名: ${c.rawName || basename(c.source)}）` });
+      continue;
+    }
+    const dest = c.isDir ? join(targetRoot, c.kebab) : join(targetRoot, `${c.kebab}.md`);
+    const paths = [join(targetRoot, c.kebab), join(targetRoot, `${c.kebab}.md`)];
+    const existing = [];
+    for (const path of paths) {
+      try {
+        await fs.stat(path);
+        existing.push(path);
+      } catch {}
+    }
+    if (existing.length) {
+      conflicts.push({ name: c.kebab, source: c.source, isDir: c.isDir, paths: existing });
+      continue;
+    }
+    pending.push({ name: c.kebab, source: c.source, isDir: c.isDir, dest });
+  }
+
+  if (dryRun) {
+    if (failed.length && pending.length === 0 && conflicts.length === 0) return failureResult();
+    return { kind: analysis.kind, pending, conflicts, failed };
+  }
+
+  await fs.mkdir(targetRoot, { recursive: true });
+
+  for (const p of pending) {
+    try {
+      if (p.isDir) await fs.cp(p.source, p.dest, { recursive: true });
+      else await fs.copyFile(p.source, p.dest);
+      imported.push({ name: p.name, overwritten: false, warnings: [] });
+      if (log) log("import", `导入 ${p.source} -> ${p.dest}`);
+    } catch (e) {
+      failed.push({ source: p.source, error: String(e && e.message ? e.message : e) });
+    }
+  }
+
+  if (conflict === "overwrite") {
+    for (const c of conflicts) {
+      try {
+        const dest = c.isDir ? join(targetRoot, c.name) : join(targetRoot, `${c.name}.md`);
+        for (const path of c.paths) await fs.rm(path, { recursive: true, force: true });
+        if (c.isDir) await fs.cp(c.source, dest, { recursive: true });
+        else await fs.copyFile(c.source, dest);
+        imported.push({ name: c.name, overwritten: true, warnings: [] });
+        if (log) log("import-overwrite", `覆盖导入 ${c.source} -> ${dest}`);
+      } catch (e) {
+        failed.push({ source: c.source, error: String(e && e.message ? e.message : e) });
+      }
+    }
+  } else {
+    for (const c of conflicts) skipped.push({ name: c.name, source: c.source });
+  }
+
+  if (failed.length && imported.length === 0) return failureResult();
+  return { kind: analysis.kind, imported, skipped, failed };
+}
+
+// ── 状态快照 ────────────────────────────────────────────────────────────────
+
+/** DSH 与公共 Agent 根目录技能快照。 */
+export async function state() {
+  const roots = userRoots();
+  const result = { roots: [] };
+  for (const root of roots) {
+    const { exists, entries } = await scanEntries(root.path);
+    const skills = [];
+    for (const e of entries) {
+      skills.push({
+        name: e.name,
+        kind: e.kind,
+        description: e.description,
+        modelInvocable: e.modelInvocable,
+        userInvocable: e.userInvocable,
+      });
+    }
+    result.roots.push({ key: root.key, path: root.path, label: root.label, mutable: root.mutable, exists, skills });
+  }
+  return result;
+}
+
+export { KEBAB_RE };

package/lib/index.js

@@ -0,0 +1,138 @@
+// dsh-skills-manager host half：设置面板的 HTTP 后端（webServer prefix 路由）
+// - 零第三方 import（仅 node: 内置 + 本地 core.js）
+// - 路由：/api/dsh-skills-manager/state | enable | disable | delete | import
+// - $DSH_HOME\skills 可上传、删除、启停；$DSH_AGENTS_HOME\skills 仅允许查看
+
+import { appendFile } from "node:fs/promises";
+import { state, setSkillEnabled, deleteSkill, importSkill, userRoots, logPath } from "./core.js";
+
+const name = "skills-manager";
+const inject = ["webServer", "skills"];
+
+function makeLog() {
+  const file = logPath();
+  return async (event, detail) => {
+    try {
+      await appendFile(file, `${JSON.stringify({ ts: new Date().toISOString(), event, detail })}\n`, "utf8");
+    } catch {
+      /* 日志失败不阻塞主流程 */
+    }
+  };
+}
+
+function readBody(req, limit = 1 << 20) {
+  return new Promise((resolve, reject) => {
+    let size = 0;
+    const chunks = [];
+    req.on("data", (c) => {
+      size += c.length;
+      if (size > limit) {
+        reject(new Error("body too large"));
+        req.destroy();
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on("end", () => {
+      try {
+        const raw = Buffer.concat(chunks).toString("utf8");
+        resolve(raw ? JSON.parse(raw) : {});
+      } catch (e) {
+        reject(new Error(`invalid JSON body: ${e.message}`));
+      }
+    });
+    req.on("error", reject);
+  });
+}
+
+function json(res, code, payload) {
+  const body = JSON.stringify(payload);
+  res.writeHead(code, {
+    "content-type": "application/json; charset=utf-8",
+    "content-length": Buffer.byteLength(body),
+  });
+  res.end(body);
+}
+
+/** 成功统一包成 { ok: true, data }；核心返回 { ok:false, error } 时透传为 400。 */
+function run(res, p, afterSuccess) {
+  p.then((r) => {
+    if (r && r.ok === false) json(res, 400, r);
+    else {
+      try {
+        if (afterSuccess) afterSuccess();
+      } catch {
+        /* 目录刷新失败不影响已完成的文件操作 */
+      }
+      json(res, 200, { ok: true, data: r });
+    }
+  }).catch((e) => {
+    try {
+      json(res, 500, { ok: false, error: String(e && e.message ? e.message : e) });
+    } catch {
+      /* response already closed */
+    }
+  });
+}
+
+function apply(ctx) {
+  const log = makeLog();
+  const roots = userRoots();
+  const rootByKey = Object.fromEntries(roots.map((r) => [r.key, r.path]));
+  let invalidateSkills = () => {};
+  ctx.effect(() => ctx.skills.registerProvider((control) => {
+    invalidateSkills = control.invalidate;
+    return {
+      name: "dsh-skills-manager-refresh",
+      list: async () => [],
+      get: async () => undefined,
+    };
+  }), "skills-manager catalog invalidator");
+
+  const route = ctx.webServer.register({
+    kind: "prefix",
+    path: "/api/dsh-skills-manager",
+    handler: async (req, res) => {
+      const u = new URL(req.url, "http://localhost");
+      const path = u.pathname.replace(/\/+$/, "");
+      try {
+        if (req.method === "GET" && path === "/api/dsh-skills-manager/state") {
+          run(res, state());
+          return;
+        }
+        if (req.method !== "POST") {
+          json(res, 405, { ok: false, error: `method not allowed: ${req.method}` });
+          return;
+        }
+        const body = await readBody(req);
+        switch (path) {
+          case "/api/dsh-skills-manager/enable": {
+            run(res, String(body.root || "dsh") === "dsh" ? setSkillEnabled(rootByKey.dsh, String(body.name || ""), true) : Promise.resolve({ ok: false, error: "公共 Agent 技能目录不允许启用或停用" }), invalidateSkills);
+            return;
+          }
+          case "/api/dsh-skills-manager/disable": {
+            run(res, String(body.root || "dsh") === "dsh" ? setSkillEnabled(rootByKey.dsh, String(body.name || ""), false) : Promise.resolve({ ok: false, error: "公共 Agent 技能目录不允许启用或停用" }), invalidateSkills);
+            return;
+          }
+          case "/api/dsh-skills-manager/delete": {
+            run(res, deleteSkill(rootByKey.dsh, String(body.name || ""), log), invalidateSkills);
+            return;
+          }
+          case "/api/dsh-skills-manager/import":
+            run(res, importSkill(String(body.source || ""), log, {
+              conflict: body.conflict === "overwrite" ? "overwrite" : "skip",
+              dryRun: body.dryRun === true,
+            }), body.dryRun === true ? undefined : invalidateSkills);
+            return;
+          default:
+            json(res, 404, { ok: false, error: `unknown action: ${path}` });
+        }
+      } catch (e) {
+        json(res, 500, { ok: false, error: String(e && e.message ? e.message : e) });
+      }
+    },
+  });
+  return route;
+}
+
+export { apply, inject, name };

package/package.json

@@ -0,0 +1,65 @@
+{
+  "name": "@michengai/dsh-skills-manager",
+  "version": "0.1.0",
+  "description": "DSH Web plugin: manage local DSH skills and safely view shared Agent skills.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MichengAI/dsh-skills-manager.git"
+  },
+  "bugs": {
+    "url": "https://github.com/MichengAI/dsh-skills-manager/issues"
+  },
+  "homepage": "https://github.com/MichengAI/dsh-skills-manager#readme",
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "assets",
+    "cordis.patch.yml"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-client-ui-workspace"
+      ],
+      "platform": "web"
+    }
+  },
+  "scripts": {
+    "test": "node test/core-test.mjs",
+    "pack:check": "npm pack --dry-run --json",
+    "prepublishOnly": "npm test"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": ">=4.0.1 <5.0.0",
+    "@deepseek-ai/dsh-host-webserver": ">=0.1.0-rc.5",
+    "@deepseek-ai/dsh-skill": ">=0.1.0-rc.5",
+    "@deepseek-ai/dsh-client-ui-workspace": ">=0.1.0-rc.5"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "deepseek-harness",
+    "dsh",
+    "dsh-plugin",
+    "skill",
+    "skills",
+    "cordis"
+  ]
+}